Bug 912982 (CVE-2013-1665)

Christian Heimes <christian> reports:

Entity declarations can contain more than just text for replacement. They can 
also point to external resources by public identifiers or system identifiers. 
System identifiers are standard URIs. When the URI is a URL (e.g. a http:// 
locator) some parsers download the resource from the remote location and embed 
them into the XML document verbatim.

Using External entity expansion opens the door to plenty of exploits. An attacker can abuse a vulnerable XML library and application to rebound and forward network 
requests with the IP address of the server. It highly depends on the parser and 
the application what kind of exploit is possible. For example:

* An attacker can circumvent firewalls and gain access to restricted resources as 
all the requests are made from an internal and trustworthy IP address, not from 
the outside.
* An attacker can abuse a service to attack, spy on or DoS your servers but also 
third party services. The attack is disguised with the IP address of the server 
and the attacker is able to utilize the high bandwidth of a big machine.
* An attacker can exhaust additional resources on the machine, e.g. with requests 
to a service that doesn't respond or responds with very large files.
* An attacker may gain knowledge, when, how often and from which IP address a XML 
document is accessed.
* An attacker could send mail from inside your network if the URL handler 
supports smtp:// URIs.

External reference:
http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html